Loading story…
Reporting highlighted how criminal groups recruit minors online using familiar platform-native language, coded messages, and “gamified” tasks across social apps (e.g., TikTok, Instagram, Snapchat), leveraging encrypted/disappearing communications to reduce visibility and shift operational risk onto replaceable young recruits. The piece emphasized that vulnerability is amplified by social and psychological factors (e.g., unstable home environments, limited support, mental health challenges), and that youth justice handling can further incentivize criminal networks to use minors as buffers between leadership and law enforcement.
Separate commentary and research coverage focused on broader human-factor dynamics in cybersecurity: a large-scale study of 1.1B Reddit posts described how users frequently seek ad-hoc incident help from strangers for issues like suspected fraud, account compromise, and scam messages, amid an environment of more automated attacks, AI-enabled deception (including voice cloning), and text/messaging-led social engineering. Another opinion piece argued that entry-level cybersecurity workforce readiness is being undermined by overreliance on LLMs in education and by hiring practices that overemphasize degrees/certifications, while a developer-focused blog framed security as an economic incentive problem—useful perspective but largely generic and not tied to a specific incident or dataset.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
A report described how organized criminal networks recruit and retain minors through social media, gaming-adjacent communities, and encrypted platforms, sometimes involving children as young as seven in the UK. It highlighted the use of gamified tasks and familiar online language to normalize progression into fraud, identity theft, and related offenses.
Researchers affiliated with Google and University College London reported findings from an analysis pipeline built over 1.1 billion Reddit posts spanning four years. They used a fine-tuned Gemini model to identify posts where people sought guidance for specific digital-risk situations and found confusion to be the dominant emotional signal.
By August 2024, Reddit users were posting more than 100,000 cybersecurity-related help questions per month, according to the researchers' analysis. Scams were the most common topic, followed by account recovery issues and privacy-tool questions.
The study found a sharp rise in cybersecurity-related help-seeking on Reddit during 2024, with volume increasing by more than 66% over the year. Researchers linked the trend to fast-evolving threats such as scams, account compromise, and deception-heavy social engineering.
Researchers found that Reddit posts seeking help for digital security, privacy, and safety problems remained relatively stable across 2021 through 2023. The analysis covered a large corpus of Reddit activity and established a baseline before a later surge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent reporting highlighted a multi-year shift in end-user security attitudes and behaviors, based on the National Cybersecurity Alliance and CybSafe’s *Oh, Behave! The Cybersecurity Attitudes and Behaviors Report: 2021–2025*, which surveyed more than **24,000** adults. The findings indicate people increasingly believe cybersecurity is “worth the effort” and more achievable, while also expecting more protection from apps and platforms—framing security as a **shared responsibility** between individuals and service providers. At the same time, the report notes growing feelings of confusion and overwhelm, suggesting a widening gap between awareness of risk and sustained adoption of protective behaviors. Separate analysis of **418** publicly announced law-enforcement actions (2021 to mid-2025), cited from Orange Cyberdefense’s *Security Navigator* and covered by *The Register*, found most arrested cybercrime suspects were **25–44** years old, with the **35–44** bracket the largest share. That demographic trend aligns with a shift toward more monetizable offenses (e.g., extortion and malware) among older cohorts. In a specific case illustrating extortion-driven cybercrime, a **22-year-old** Alabama man, **Jamarcus Mosley**, pleaded guilty to hacking and extorting hundreds of women by impersonating acquaintances to obtain account recovery codes and passwords, hijacking social-media accounts (including Snapchat and Instagram), and threatening to leak intimate content unless victims complied with demands for additional access, explicit material, or payments.
Jun 29, 2026
Security reporting and research highlighted how **AI and automation are reshaping both attacker tradecraft and defender operations**, while introducing new enterprise risk. ZDNET described research findings that **agentic AI implementations** from *ServiceNow* and *Microsoft* can be **exploitable**, warning that broadly permissioned agents could enable **lateral movement and privilege escalation** across systems of record if an attacker compromises an agent or chains between agents with different access levels; a **least-privilege** posture for agents was emphasized. Dark Reading separately reported that **AI agents are increasingly augmenting—and in some cases supplanting—human penetration testing** for “low-hanging” vulnerabilities, but that **false positives and the need for human oversight** remain material constraints as agentic testing matures. Threat-intelligence coverage also underscored the **industrialization of cybercrime** and the ecosystems enabling it. CloudSEK detailed the evolution of the English-speaking cybercriminal milieu known as **“The COM,”** tracing its roots in OG-handle trading communities and forum migrations into a service-oriented underground linked to groups such as **Lapsus$**, **ShinyHunters**, **Scattered Spider (UNC3944)**, and **Silent Ransom Group**, and associated activity spanning breaches, extortion, SIM swapping, ransomware, and crypto fraud. SC Media’s commentary similarly described a cyber underground where criminals can readily buy capabilities (credentials, tooling, automation), calling out techniques including **carding** and **ClickFix** social engineering that tricks users into running copied commands to install infostealers. Separately, Dark Reading reported allegations that the **Chronus Group** posted **2.3TB** of purported Mexican government data affecting up to **36 million** people, while Mexico’s **ATDT** disputed it as largely **repackaged data from prior breaches** and said no new sensitive accounts were identified and that impacted systems were primarily **obsolete, third-party-administered** state-level platforms.
Jun 29, 2026
Reporting in this set is not a single coherent incident; it is a **mixed roundup** dominated by (1) **AI-enabled cryptocurrency fraud** and (2) **DDoS activity and botnet trends**, alongside several forward-looking or non-incident items. Chainalysis-linked coverage describes industrialized crypto crime, including an estimate of **$17B in 2025 crypto-scam losses** and a sharp rise in **AI-driven impersonation/deepfake tactics**, with links to organized crime networks and forced-labor scam compounds in **Cambodia and Myanmar**; separate reporting notes a **$26.44M theft from the Ethereum-based Truebit protocol**, with Truebit urging users to avoid a **compromised smart contract** while investigations continue. In parallel, threat reporting highlights large-scale DDoS: Cloudflare’s mitigation of a **29.7 Tbps** burst attributed to the **AISURU** botnet-for-hire (plus a **14.1 Bpps** event and an estimated **1–4M** infected hosts), and a concentrated **NoName057(16)/DDoSia** campaign against the **UK** (1,812 attack entries targeting 86 domains/87 IPs, heavily hitting government and some critical infrastructure, with port **443** most targeted). Spamhaus also reports a **24% increase** in botnet C2 activity in 2H 2025, with **RATs** comprising a large share of top botnet-associated malware. Several items are **not incident-driven** and should be treated as lower-signal for operational response: SC Media and Security Boulevard pieces largely provide **2026 predictions/opinion** on *agentic AI*, **non-human identities (NHIs)**, and deepfakes as governance/identity risks; Dark Reading and CIO discuss **regulatory/compliance** and **IT leadership** challenges; TechTarget lists **2026 conferences**; and two Substack posts are general **news roundup/essay** content (one recounting lessons from Ukraine’s cyber conflict, including the Kyivstar destructive attack narrative). For CISOs, the actionable takeaways across the incident-focused items are: expect continued growth in **AI-assisted social engineering and deepfake fraud** impacting financial loss and brand trust; maintain smart-contract incident playbooks for rapid user guidance; and harden DDoS readiness (capacity planning, upstream mitigation, and monitoring) given both **record-scale botnet bursts** and **geopolitically motivated DDoS** targeting government and critical infrastructure.
Jun 29, 2026